Analysis
-
max time kernel
93s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 04:39
Static task
static1
Behavioral task
behavioral1
Sample
0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe
Resource
win10v2004-20230221-en
General
-
Target
0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe
-
Size
690KB
-
MD5
6f976bf732c5b8dfc2da09b48fa3aa48
-
SHA1
69618ea4455f18581b52a68b30275024785130a8
-
SHA256
0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d
-
SHA512
0b52fe43c1afb4408e4b9cc18b497521c6cfee10ac9eca212eeb2ef49496768a70fcad76edf456cf0c0c294ce33cbda5af7df209b113909e2b6a075fb7d215a5
-
SSDEEP
12288:+Mruy90V2KYLGTgxsEG54vyL65hLuriKjUp8Zvv/vuF5GfigSIfzguqve:sypLILEG54KWfaTkmq5GagTzqm
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
pro9467.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9467.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9467.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/5004-191-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-192-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-194-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-196-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-198-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-200-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-202-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-204-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-206-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-208-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-210-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-212-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-214-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-216-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-218-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-220-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-222-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-224-0x00000000065B0000-0x00000000065EF000-memory.dmp family_redline behavioral1/memory/5004-331-0x0000000005FB0000-0x0000000005FC0000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un357553.exepro9467.exequ6626.exesi672386.exepid process 4612 un357553.exe 3776 pro9467.exe 5004 qu6626.exe 1128 si672386.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9467.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9467.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exeun357553.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un357553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un357553.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3796 3776 WerFault.exe pro9467.exe 4468 5004 WerFault.exe qu6626.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9467.exequ6626.exesi672386.exepid process 3776 pro9467.exe 3776 pro9467.exe 5004 qu6626.exe 5004 qu6626.exe 1128 si672386.exe 1128 si672386.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9467.exequ6626.exesi672386.exedescription pid process Token: SeDebugPrivilege 3776 pro9467.exe Token: SeDebugPrivilege 5004 qu6626.exe Token: SeDebugPrivilege 1128 si672386.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exeun357553.exedescription pid process target process PID 4824 wrote to memory of 4612 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe un357553.exe PID 4824 wrote to memory of 4612 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe un357553.exe PID 4824 wrote to memory of 4612 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe un357553.exe PID 4612 wrote to memory of 3776 4612 un357553.exe pro9467.exe PID 4612 wrote to memory of 3776 4612 un357553.exe pro9467.exe PID 4612 wrote to memory of 3776 4612 un357553.exe pro9467.exe PID 4612 wrote to memory of 5004 4612 un357553.exe qu6626.exe PID 4612 wrote to memory of 5004 4612 un357553.exe qu6626.exe PID 4612 wrote to memory of 5004 4612 un357553.exe qu6626.exe PID 4824 wrote to memory of 1128 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe si672386.exe PID 4824 wrote to memory of 1128 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe si672386.exe PID 4824 wrote to memory of 1128 4824 0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe si672386.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe"C:\Users\Admin\AppData\Local\Temp\0ae931e5baf18fefe00b62934f12564501b370cefa28c23c32249426d132683d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357553.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357553.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9467.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9467.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 10484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6626.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6626.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 15364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672386.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672386.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3776 -ip 37761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5004 -ip 50041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672386.exeFilesize
175KB
MD5b33f6ede48b991891f128dcbbe25847c
SHA11026606d8f41d5c8ceb9b5d80f44ac31f1d28693
SHA25640116fce955a44434aad297737ec07a68615fe487b3a16725dfa56722cdda134
SHA512c984c8597f0767d2613f13e16726387215d7bc6d7a2373d5e22f63d0b336164bf3f6f9407230139db9572302b24c79fa57b2372aa4ecfab9d0639b7be06f17dc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si672386.exeFilesize
175KB
MD5b33f6ede48b991891f128dcbbe25847c
SHA11026606d8f41d5c8ceb9b5d80f44ac31f1d28693
SHA25640116fce955a44434aad297737ec07a68615fe487b3a16725dfa56722cdda134
SHA512c984c8597f0767d2613f13e16726387215d7bc6d7a2373d5e22f63d0b336164bf3f6f9407230139db9572302b24c79fa57b2372aa4ecfab9d0639b7be06f17dc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357553.exeFilesize
548KB
MD5f0e4784f7080753a99b6d879d707aed1
SHA162c2abbd7467796639b31a129b138406b7256906
SHA256ea61abc8770d1b326f1d12d1903600d1fb046338aa6dce55a1a6f14d73f531b8
SHA5127980d1e9a67bfe3ab671002e20d75d3799c4def42e8a704a9e0b3f39be670caaf896e0cfa0cc4951b6ba4b33360398aaaec2304d61ec37fc4e9aa683baff8cf9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357553.exeFilesize
548KB
MD5f0e4784f7080753a99b6d879d707aed1
SHA162c2abbd7467796639b31a129b138406b7256906
SHA256ea61abc8770d1b326f1d12d1903600d1fb046338aa6dce55a1a6f14d73f531b8
SHA5127980d1e9a67bfe3ab671002e20d75d3799c4def42e8a704a9e0b3f39be670caaf896e0cfa0cc4951b6ba4b33360398aaaec2304d61ec37fc4e9aa683baff8cf9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9467.exeFilesize
291KB
MD51bc15a91cf9d3cdd2101681903aea76a
SHA1392121f8774470718cdb1e57ed64e8218421c57d
SHA25639ebce67391d6cb29a80260f4e82141dbea95bcd32458f4f4386edc7c37da6a3
SHA51250652984ecc2f84463e5d34534c359d48b0554c0e0ad313342ca582b52dbbcd35afbb14cd3d74421dfb6a074ca07d7f674e95c47f76cbd6654b37a67535ca5de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9467.exeFilesize
291KB
MD51bc15a91cf9d3cdd2101681903aea76a
SHA1392121f8774470718cdb1e57ed64e8218421c57d
SHA25639ebce67391d6cb29a80260f4e82141dbea95bcd32458f4f4386edc7c37da6a3
SHA51250652984ecc2f84463e5d34534c359d48b0554c0e0ad313342ca582b52dbbcd35afbb14cd3d74421dfb6a074ca07d7f674e95c47f76cbd6654b37a67535ca5de
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6626.exeFilesize
345KB
MD5481179e5257ec8bb581989134c6bb4c8
SHA1ac7ed69cec4f7478e048762675f7f94a806a25c2
SHA256cb1e7f7f1d439dc9943cb827f65338996740d150ad7c660ef4dda7d6c18f76f7
SHA512940cccf758c992f61d649377e7cf1224123d9b2dd859f25b928b900c760cca59a75807dcd8b8a435320a9a153e071932450382b5f6da28ed164c0894cd9b73c5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6626.exeFilesize
345KB
MD5481179e5257ec8bb581989134c6bb4c8
SHA1ac7ed69cec4f7478e048762675f7f94a806a25c2
SHA256cb1e7f7f1d439dc9943cb827f65338996740d150ad7c660ef4dda7d6c18f76f7
SHA512940cccf758c992f61d649377e7cf1224123d9b2dd859f25b928b900c760cca59a75807dcd8b8a435320a9a153e071932450382b5f6da28ed164c0894cd9b73c5
-
memory/1128-1121-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/1128-1122-0x0000000005920000-0x0000000005930000-memory.dmpFilesize
64KB
-
memory/1128-1123-0x0000000005920000-0x0000000005930000-memory.dmpFilesize
64KB
-
memory/3776-161-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-173-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-152-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-153-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-155-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-157-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-159-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-150-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-163-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-165-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-167-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-169-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-171-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-151-0x0000000004CC0000-0x0000000005264000-memory.dmpFilesize
5.6MB
-
memory/3776-175-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-177-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-179-0x0000000002720000-0x0000000002732000-memory.dmpFilesize
72KB
-
memory/3776-180-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-181-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-182-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3776-183-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-185-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-186-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3776-149-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3776-148-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/5004-194-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-196-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-198-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-200-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-202-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-204-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-206-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-208-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-210-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-212-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-214-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-216-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-218-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-220-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-222-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-224-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-329-0x0000000001A30000-0x0000000001A7B000-memory.dmpFilesize
300KB
-
memory/5004-331-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-333-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-335-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-1101-0x0000000006630000-0x0000000006C48000-memory.dmpFilesize
6.1MB
-
memory/5004-1102-0x0000000006CD0000-0x0000000006DDA000-memory.dmpFilesize
1.0MB
-
memory/5004-1103-0x0000000006E10000-0x0000000006E22000-memory.dmpFilesize
72KB
-
memory/5004-1104-0x0000000006E30000-0x0000000006E6C000-memory.dmpFilesize
240KB
-
memory/5004-1105-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-1106-0x0000000007120000-0x00000000071B2000-memory.dmpFilesize
584KB
-
memory/5004-1107-0x00000000071C0000-0x0000000007226000-memory.dmpFilesize
408KB
-
memory/5004-1108-0x00000000079C0000-0x0000000007A36000-memory.dmpFilesize
472KB
-
memory/5004-1109-0x0000000007A50000-0x0000000007AA0000-memory.dmpFilesize
320KB
-
memory/5004-1111-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-1112-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-192-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-191-0x00000000065B0000-0x00000000065EF000-memory.dmpFilesize
252KB
-
memory/5004-1113-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/5004-1114-0x0000000008DC0000-0x0000000008F82000-memory.dmpFilesize
1.8MB
-
memory/5004-1115-0x0000000008F90000-0x00000000094BC000-memory.dmpFilesize
5.2MB